An abnormal transaction warning method and device

Abstract

The present application provides an abnormal transaction warning method and device, which relates to the field of big data and can also be used in the financial field. The method includes: determining a first abnormal degree of the transaction request according to the transaction request of the transaction initiator and first historical transaction data; when the first abnormal degree is lower than a preset first risk threshold, determining a second abnormal degree of the transaction recipient according to second historical transaction data of the transaction recipient; and performing abnormal transaction warning processing according to the second abnormal degree and a preset second risk threshold. The present application can perform abnormal transaction warning according to the historical transaction data of the transaction initiator and the transaction recipient.

Description

Technical Field

[0001] The present application relates to the field of big data and can be used in the financial field. Specifically, it is an abnormal transaction warning method and device. Background Art

[0002] With the popularization of card-making technology in recent years, the problem of financial account fraud has become increasingly serious. Fraudsters may use some improper means to cause financial losses to financial institutions or their customers.

[0003] To solve the above problems, various financial institutions have introduced manual supervision mechanisms in electronic trading channels. However, reducing the fraud risk through manual review has defects such as low accuracy, high labor costs, and poor timeliness.

[0004] Although various financial institutions have considered the above defects and introduced expert systems on the basis of manual supervision, their models are single and their robustness is poor, making it difficult to adapt to the ever-changing trading scenarios. Existing abnormal transaction detection methods usually use the Minkowski Distance (hereinafter referred to as distance) to determine the difference degree between the test sample point and the historical data point. This method is not applicable to trading scenarios with a large amount of trading information and a wide range of trading data dimensions. Because when the distribution of trading parameter values in a certain dimension varies greatly, the difference degree between two points will be more biased towards the difference in this dimension and is not sensitive to the difference degrees in other dimensions. In addition, this method is not sensitive to the distribution density of data. It usually only calculates the distance between the test sample point and the historical data point under a certain current dimension. When the data is unevenly distributed in each dimension, the calculation result has a large deviation. Summary of the Invention

[0005] Aiming at the problems in the prior art, the present application provides an abnormal transaction warning method and device, which can perform abnormal transaction warning based on the historical transaction data of the transaction initiator and the transaction recipient.

[0006] To solve the above technical problems, the present application provides the following technical solutions:

[0007] In a first aspect, the present application provides an abnormal transaction warning method, including:

[0008] Determine a first abnormal degree of the transaction request according to the transaction request of the transaction initiator and the first historical transaction data;

[0009] When the first abnormal degree is lower than a preset first risk threshold, determine a second abnormal degree of the transaction recipient according to the second historical transaction data of the transaction recipient;

[0010] Perform abnormal transaction warning processing according to the second abnormal degree and a preset second risk threshold.

[0011] Further, determining the first abnormal degree of the transaction request according to the transaction request of the transaction initiator and the first historical transaction data includes:

[0012] Traverse the first historical transaction data of each historical transaction, and calculate the first abnormal value corresponding to each first historical transaction data according to the transaction request and each first historical transaction data;

[0013] Determine the first abnormal degree according to each first abnormal value and the number of the first historical transaction data.

[0014] Further, traversing the first historical transaction data of each historical transaction, and calculating the first abnormal value corresponding to each first historical transaction data according to the transaction request and each first historical transaction data includes:

[0015] Determine multiple first transaction information dimensions according to the transaction request;

[0016] For each first transaction information dimension, input the current transaction value of the transaction request under this first transaction information dimension and the historical transaction value of the first historical transaction data under this first transaction information dimension into an indication function to obtain the first dimension abnormal value of the transaction request under this first transaction information dimension;

[0017] Determine the first abnormal value according to each first dimension abnormal value and the number of the first transaction information dimensions.

[0018] Further, the second historical transaction data includes: historical transaction data to be measured and reference historical transaction data; determining the second abnormal degree of the transaction recipient according to the second historical transaction data of the transaction recipient includes:

[0019] Traverse the reference historical transaction data, and calculate the second abnormal value corresponding to each reference historical transaction data according to the historical transaction data to be measured and each reference historical transaction data;

[0020] Determine the second abnormal degree according to each second abnormal value and the number of the reference historical transaction data;

[0021] Adjust the second abnormal degree by using an exponential smoothing algorithm.

[0022] Further, calculating the second abnormal value corresponding to each reference historical transaction data according to the historical transaction data to be measured and each reference historical transaction data includes:

[0023] Determine multiple second transaction information dimensions according to the historical transaction data to be measured;

[0024] For each second transaction information dimension, input the measured transaction value of the historical transaction data to be measured under this second transaction information dimension and the reference transaction value of the reference historical transaction data under this second transaction information dimension into an indication function to obtain the second dimension outlier of the historical transaction data to be measured under this second transaction information dimension;

[0025] Determine the second outlier according to each second dimension outlier and the number of the second transaction information dimensions.

[0026] Further, the abnormal transaction warning method further includes:

[0027] Obtain the first historical transaction data and / or the second historical transaction data from the historical transaction database.

[0028] Further, the abnormal transaction warning method further includes:

[0029] When the first abnormal degree is higher than the first risk threshold, perform an abnormal transaction warning on the transaction request.

[0030] Further, the performing abnormal transaction warning processing according to the second abnormal degree and a preset second risk threshold includes:

[0031] When the second abnormal degree is higher than the second risk threshold, perform an abnormal transaction warning on the transaction request.

[0032] In a second aspect, the present application provides an abnormal transaction warning device, including:

[0033] A first abnormal degree determination unit, configured to determine the first abnormal degree of the transaction request according to the transaction request of the transaction initiator and the first historical transaction data;

[0034] A second abnormal degree determination unit, configured to, when the first abnormal degree is lower than a preset first risk threshold, determine the second abnormal degree of the transaction recipient according to the second historical transaction data of the transaction recipient;

[0035] A warning processing unit, configured to perform abnormal transaction warning processing according to the second abnormal degree and a preset second risk threshold.

[0036] Further, the first abnormal degree determination unit includes:

[0037] A first outlier determination module, configured to traverse the first historical transaction data of each historical transaction, and calculate the first outlier corresponding to each first historical transaction data according to the transaction request and each first historical transaction data;

[0038] The first anomaly degree determination module is used to determine the first anomaly degree according to each of the first anomaly values and the number of the first historical transaction data.

[0039] Further, the first anomaly value determination module includes:

[0040] The first dimension determination sub-module is used to determine a plurality of first transaction information dimensions according to the transaction request;

[0041] The first dimension anomaly value determination sub-module is used to input the current transaction value of the transaction request under each first transaction information dimension and the historical transaction value of the first historical transaction data under the first transaction information dimension into an indicator function for each first transaction information dimension, so as to obtain the first dimension anomaly value of the transaction request under the first transaction information dimension;

[0042] The first anomaly value determination sub-module is used to determine the first anomaly value according to each first dimension anomaly value and the number of the first transaction information dimensions.

[0043] Further, the second historical transaction data includes: the historical transaction data to be measured and the reference historical transaction data; the second anomaly degree determination unit includes:

[0044] The second anomaly value determination module is used to traverse the reference historical transaction data and calculate the second anomaly value corresponding to each reference historical transaction data according to the historical transaction data to be measured and each reference historical transaction data;

[0045] The second anomaly degree determination module is used to determine the second anomaly degree according to each of the second anomaly values and the number of the reference historical transaction data;

[0046] The second anomaly degree adjustment module is used to adjust the second anomaly degree by using an exponential smoothing algorithm.

[0047] Further, the second anomaly value determination module includes:

[0048] The second dimension determination sub-module is used to determine a plurality of second transaction information dimensions according to the historical transaction data to be measured;

[0049] The second dimension anomaly value determination sub-module is used to input the to-be-measured transaction value of the historical transaction data to be measured under each second transaction information dimension and the reference transaction value of the reference historical transaction data under the second transaction information dimension into an indicator function for each second transaction information dimension, so as to obtain the second dimension anomaly value of the historical transaction data to be measured under the second transaction information dimension;

[0050] The second outlier determination sub-module is used to determine the second outlier according to each second-dimensional outlier and the number of dimensions of the second transaction information dimension.

[0051] Furthermore, the abnormal transaction warning device is further specifically used for:

[0052] Obtain the first historical transaction data and / or the second historical transaction data from the historical transaction database.

[0053] Furthermore, the abnormal transaction warning device is further specifically used for:

[0054] When the first abnormal degree is higher than the first risk threshold, give an abnormal transaction warning for the transaction request.

[0055] Furthermore, for the abnormal transaction warning method, the warning processing unit includes:

[0056] When the second abnormal degree is higher than the second risk threshold, give an abnormal transaction warning for the transaction request.

[0057] In a third aspect, the present application provides an electronic device including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, the steps of the abnormal transaction warning method are implemented.

[0058] In a fourth aspect, the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the abnormal transaction warning method are implemented.

[0059] In a fifth aspect, the present application provides a computer program product, including a computer program / instructions. When the computer program / instructions are executed by a processor, the steps of the abnormal transaction warning method are implemented.

[0060] Aiming at the problems in the prior art, the abnormal transaction warning method and device provided by the present application can calculate the abnormal degree of the transaction request according to the distribution of the transaction request and historical transaction data in hyperspace. Compared with the existing Minkowski distance, it is more sensitive to the uneven distribution density of data in space and can more accurately distinguish the abnormal degree of transactions; through the transaction account grey list, transactions transferring funds to the grey list can be quickly screened out, improving the abnormal detection efficiency of the system. Description of the Drawings

[0061] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the accompanying drawings required for the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other accompanying drawings can be obtained based on these drawings.

[0062] Figure 1 It is a flowchart of the abnormal transaction warning method in the embodiment of the present application;

[0063] Figure 2 It is a flowchart of determining the first abnormal degree of a transaction request in the embodiment of the present application;

[0064] Figure 3 It is a flowchart of obtaining the first abnormal value in the embodiment of the present application;

[0065] Figure 4 It is a flowchart of determining the second abnormal degree in the embodiment of the present application;

[0066] Figure 5 It is a flowchart of determining the second abnormal value in the embodiment of the present application;

[0067] Figure 6 It is a structural diagram of the abnormal transaction warning device in the embodiment of the present application;

[0068] Figure 7 It is a structural diagram of the first abnormal degree determination unit in the embodiment of the present application;

[0069] Figure 8 It is a structural diagram of the first abnormal value determination module in the embodiment of the present application;

[0070] Figure 9 It is a structural diagram of the second abnormal degree determination unit in the embodiment of the present application;

[0071] Figure 10 It is a structural diagram of the second abnormal value determination module in the embodiment of the present application;

[0072] Figure 11 It is a schematic structural diagram of the electronic device in the embodiment of the present application;

[0073] Figure 12 It is a schematic diagram of the business process in the embodiment of the present application. Detailed implementation manners

[0074] Next, the technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present application without making creative efforts shall fall within the protection scope of the present application.

[0075] It should be noted that the abnormal transaction warning method and device provided in the present application can be used in the financial field or any field other than the financial field. The application fields of the abnormal transaction warning method and device provided in the present application are not limited.

[0076] In one embodiment, referring to Figure 1 , in order to be able to perform abnormal transaction warning based on the historical transaction data of the transaction initiator and the transaction recipient, the present application provides an abnormal transaction warning method, including:

[0077] S101: Determine the first abnormal degree of the transaction request according to the transaction request of the transaction initiator and the first historical transaction data;

[0078] S102: When the first abnormal degree is lower than the preset first risk threshold, determine the second abnormal degree of the transaction recipient according to the second historical transaction data of the transaction recipient;

[0079] S103: Perform abnormal transaction warning processing according to the second abnormal degree and the preset second risk threshold.

[0080] It can be understood that generally speaking, for financial institutions including banks, the occurrence of abnormal transactions is often a small probability event, while normal transactions often account for the vast majority. In order to detect abnormal transactions in the electronic transaction channels of financial institutions, the prior art constructs a transaction data distribution model and uses it to measure the abnormal degree of the current transaction. However, since the proportion of abnormal transactions in all transactions is relatively small and the data sampling density is uneven, the constructed transaction data distribution model is difficult to accurately detect abnormal transactions.

[0081] Therefore, the embodiments of the present application provide a method for detecting abnormal transactions in bank electronic channels based on hyperspace distribution, which improves the method of constructing a transaction data distribution model, can more accurately measure the abnormal degree of the current transaction, and is more in line with the transaction characteristics of the current account. The execution subject of the above method can be the background server of a financial institution, but the present application is not limited thereto.

[0082] Specifically, referring to Figure 12, after the transaction initiator sends a transaction request to the server of the financial institution through a client (including but not limited to mobile terminals such as mobile phones), the server automatically retrieves the first historical transaction data of the transaction initiator and the relevant information of the transaction request from the database. Among them, the relevant information of the transaction request includes but is not limited to the transaction amount, transaction channel, transaction geographical location, transaction time, and the account of the transaction recipient; the first historical transaction data includes but is not limited to the number of transaction records of the transaction initiator within a unit time, the number of transactions with a single transaction amount greater than a set value within a unit time, the number of failed transactions within a unit time, and the number of transactions for each channel, which can be obtained from the historical transaction database according to the transaction initiator. Among them, the unit time can be the first 30 natural days before the current transaction request.

[0083] According to the transaction request of the transaction initiator and the first historical transaction data, the first abnormal degree of the transaction request can be determined; it should be noted that in order to obtain the first abnormal degree, it is necessary to use the first historical transaction data to pre-construct a transaction risk analysis model. That is to say, the first abnormal degree is obtained by using the pre-constructed transaction risk analysis model. The specific model construction method is described in detail below.

[0084] If the first abnormal degree is lower than the preset first risk threshold, it is also necessary to determine the second abnormal degree of the transaction recipient according to the second historical transaction data of the transaction recipient; only when both the first abnormal degree and the second abnormal degree meet the corresponding thresholds, the current transaction request is regarded as a normal transaction, otherwise an abnormal transaction warning needs to be issued. Among them, the second abnormal degree is also obtained by using the pre-constructed account risk analysis model; the second historical transaction data includes but is not limited to the number of transaction records of the transaction recipient (hereinafter also referred to as the counterparty account) within a unit time, the number of transactions with a single transaction amount greater than a set value within a unit time, the number of failed transactions within a unit time, and the number of transactions for each channel.

[0085] It should be noted that see Figure 12 , after receiving the transaction request, the server can also first query whether the counterparty account exists in the transaction abnormal gray list. If it exists in the gray list, it is warned that the current transaction request is risky. If the transaction initiator chooses to continue the transaction, the current transaction request will be transferred to the manual processing process. If the counterparty account does not exist in the gray list, the abnormal transaction detection algorithm (that is, the abnormal transaction warning method provided in the embodiment of the present application) can be invoked to calculate the abnormal degree of the current transaction request. If the transaction request of the transaction initiator is abnormal, a transaction abnormal alarm will be generated and transferred to manual processing.

[0086] That is to say, when there are abnormal situations in the opponent's account, the opponent's account can be recorded in the gray list, and at the same time, the current transaction request can be transferred to manual processing. Since in actual business experience, the reasons for abnormal transactions often occur on the side of the receiving account (opponent's account), the gray list of transaction accounts can quickly and roughly screen out whether there is a possibility of abnormality in the current transaction request, so as to comprehensively determine all transaction information related to the opponent's account and improve the recall rate of abnormal transaction detection.

[0087] As can be seen from the above description, the abnormal transaction warning method provided by this application can calculate the abnormality degree of this transaction request based on the distribution of the transaction request and historical transaction data in hyperspace. Compared with the existing Minkowski distance, it is more sensitive to the uneven distribution density of data in space and can more accurately distinguish the abnormality degree of transactions; through the gray list of transaction accounts, transactions transferring to the gray list can be quickly screened out, improving the abnormal detection efficiency of the system.

[0088] In one embodiment, referring to Figure 2 , determining the first abnormality degree of the transaction request according to the transaction request of the transaction initiator and the first historical transaction data includes:

[0089] S201: Traverse the first historical transaction data of each historical transaction, and calculate the first abnormal value corresponding to each first historical transaction data according to the transaction request and each first historical transaction data;

[0090] S202: Determine the first abnormality degree according to each first abnormal value and the number of first historical transaction data.

[0091] It can be understood that in one embodiment, referring to Figure 3 , step S201 specifically includes: determining multiple first transaction information dimensions according to the transaction request (S301); for each first transaction information dimension, input the current transaction value of the transaction request under this first transaction information dimension and the historical transaction value of the first historical transaction data under this first transaction information dimension into the indicator function to obtain the first dimension abnormal value of the transaction request under this first transaction information dimension (S302); determine the first abnormal value according to each first dimension abnormal value and the number of first transaction information dimensions (S303).

[0092] Specifically, define R i (x, y) as the region between x and y in the i-th dimension x i and y i ; x ∈ N, N is the historical transaction data set (which records the first historical transaction data), x is the first historical transaction data (where there are multiple first historical transaction data), x i is the value of the i-th dimension of x, y is the data of the current transaction request, y iis the value of the i-th dimension of y, where i represents the dimension. The concept of dimension can be understood as follows: x and y contain the statistical data of the above historical transactions (i.e., the first historical transaction data) and the relevant information of the current transaction request, such as transaction amount, transaction channel, etc. Each type of information is a dimension, so they are respectively high-dimensional data points.

[0093]

[0094] Among them, I(·) is the indicator function, and z is other transaction data points in N except x. Then, taking the proportion of M i (x, y|N) in N as the dissimilarity degree between x and y in the i-th dimension, calculate the dissimilarity degree between x and y in all dimensions, as shown in the following formula, where n is the dimension of the data, and p is the adjustment coefficient, only to make the value range of the following formula in [0, 1], expressed as a probability value.

[0095]

[0096] Calculate the dissimilarity degree between the current transaction data corresponding to the current transaction request and each first historical transaction data, obtain the anomaly score, and then add up all the anomaly scores to get the anomaly score of this transaction. The algorithm process is as follows:

[0097]

[0098] If, according to the above algorithm, it is calculated that the current transaction request of the transaction initiator is a normal transaction, the historical transaction information of the counterparty account can be retrieved, and the transaction anomaly score of the counterparty account within a unit time can be calculated to determine whether the counterparty account is abnormal.

[0099] From the above description, it can be seen that the abnormal transaction warning method provided by this application can determine the first abnormal degree of the transaction request according to the transaction request of the transaction initiator and the first historical transaction data.

[0100] In one embodiment, refer to Figure 4 , the second historical transaction data includes: the historical transaction data to be measured and the reference historical transaction data; determining the second abnormal degree of the transaction recipient according to the second historical transaction data of the transaction recipient includes:

[0101] S401: Traverse the reference historical transaction data, and calculate the corresponding second abnormal value of each reference historical transaction data according to the historical transaction data to be measured and each reference historical transaction data;

[0102] S402: Determine the second abnormal degree according to each second abnormal value and the number of reference historical transaction data;

[0103] S403: Adjust the second abnormal degree using the exponential smoothing algorithm.

[0104] It is understandable that in one embodiment, referring to Figure 5 , step S401 specifically includes: determining a plurality of second transaction information dimensions according to the historical transaction data to be measured (S501); for each second transaction information dimension, inputting the to-be-measured transaction value of the historical transaction data to be measured and the reference transaction value of the reference historical transaction data under the second transaction information dimension into an indication function to obtain a second dimension outlier of the historical transaction data to be measured under the second transaction information dimension (S502); and determining a second outlier according to each second dimension outlier and the number of second transaction information dimensions (S503).

[0105] Specifically, for the abnormal state of the counterparty account, the transaction risk analysis model in the embodiments of the present application can also be used for measurement. First, for the transaction state of the counterparty account, the number of recent transactions t needs to be set, the data set is O, and the above algorithm is The abnormal state of the account transaction can be calculated by weighted averaging the abnormal states of recent transactions, so as to obtain the abnormal state of the current account. Among them, ω is a smoothing adjustment coefficient, which is used to adjust the weight decline speed of the second historical transaction data. The closer the transaction time is, the higher the weight. The value range of ω is [0, ∞]. C(t) is the abnormal state of the counterparty account, and the value range is [0, 1]. The weight is adjusted by the smoothing adjustment coefficient.

[0106]

[0107] For example, assume that the dimensions of the collected data are two-dimensional, namely the transaction amount dimension and the number of transactions per unit time dimension. Let x ∈ N, where N is the historical transaction data set (which records the first historical transaction data and the second historical transaction data), and y is the data of the current transaction request.

[0108] Regarding the abnormal state detection part of the transaction initiator:

[0109] First, let the first data point in N be x, and traverse the two dimensions. For the transaction amount dimension, use the function M i (x, y|N) to count the number of data points between x and y in the data set N in the transaction amount dimension, where j is 0, that is, the first dimension. Then, use the formula D′(x, y) to calculate the dissimilarity score between x and y in the above two dimensions. By analogy, loop through the data points in N, respectively let the data point be x, obtain the cumulative value P(y) of the abnormal score of y, and finally P(y) / N_num is the abnormal score of this transaction.

[0110] Regarding the abnormal state detection part of the transaction recipient (counterparty account):

[0111] Assume that t takes 5, Q(On ) The calculated abnormal scores of the opponent's account for the last five transactions are 0.1, 0.1, 0.8, 0.8, and 0.9 respectively. The adjustment coefficient is 1. The abnormal score C(t) of this account is 0.834. When taking the average of the five values, the abnormal score is 0.54. According to the change in the abnormal degree of the account's recent transactions, it can be seen that the abnormal degree gradually increases. The historical normal transactions make the average value of this account not consider the time factor, resulting in a lower conclusion and being insensitive to the abnormal fluctuations of the account. Through the above method, the account can be more sensitive to abnormal fluctuations and can give early warnings in a timely manner.

[0112] In the dimension of transaction amount, the single transaction amount of the account will be within a stable range, such as between 0 and 1000; there will be relatively large amounts for fixed transactions such as monthly regular salary income, which are one or more orders of magnitude higher, for example, 10,000 yuan. When calculating using the traditional Minkowski distance, transactions with relatively large amounts such as salary income are easily identified as outliers because their values are much higher than daily transactions. However, if calculated using the algorithm provided in the embodiments of the present application, since there are not many transaction records between 10,000 yuan and the larger value of daily transactions, the dissimilarity score of the two transactions obtained in the algorithm is lower than the score of the Minkowski distance, thus avoiding the determination of transaction records with relatively large values as abnormal transactions due to the large difference in relative values.

[0113] As can be seen from the above description, the abnormal transaction warning method provided by the present application can determine the second abnormal degree of the transaction recipient according to the second historical transaction data of the transaction recipient.

[0114] In one embodiment, refer to Figure 12 , the abnormal transaction warning method further includes: obtaining the first historical transaction data and / or the second historical transaction data from the historical transaction database.

[0115] In one embodiment, refer to Figure 12 , the abnormal transaction warning method further includes: when the first abnormal degree is higher than the first risk threshold, giving an abnormal transaction warning for the transaction request.

[0116] In one embodiment, refer to Figure 12 , performing abnormal transaction warning processing according to the second abnormal degree and the preset second risk threshold, including: when the second abnormal degree is higher than the second risk threshold, giving an abnormal transaction warning for the transaction request.

[0117] Based on the same inventive concept, an embodiment of the present application further provides an abnormal transaction warning device, which can be used to implement the method described in the above embodiment, as described in the following embodiment. Since the principle of the abnormal transaction warning device for solving problems is similar to that of the abnormal transaction warning method, the implementation of the abnormal transaction warning device can refer to the implementation of the method for determining software performance benchmarks, and the repeated parts will not be described again. As used hereinafter, the term "unit" or "module" may be a combination of software and / or hardware that can implement a predetermined function. Although the systems described in the following embodiments are preferably implemented in software, implementation in hardware, or a combination of software and hardware is also possible and contemplated.

[0118] In one embodiment, referring to Figure 6 , in order to be able to perform abnormal transaction warning based on the historical transaction data of the transaction initiator and the transaction recipient, the present application provides an abnormal transaction warning device, including: a first abnormal degree determination unit 601, a second abnormal degree determination unit 602, and a warning processing unit 603.

[0119] The first abnormal degree determination unit 601 is configured to determine a first abnormal degree of the transaction request according to the transaction request of the transaction initiator and the first historical transaction data;

[0120] The second abnormal degree determination unit 602 is configured to determine a second abnormal degree of the transaction recipient according to the second historical transaction data of the transaction recipient when the first abnormal degree is lower than a preset first risk threshold;

[0121] The warning processing unit 603 is configured to perform abnormal transaction warning processing according to the second abnormal degree and a preset second risk threshold.

[0122] In one embodiment, referring to Figure 7 , the first abnormal degree determination unit 601 includes: a first abnormal value determination module 701 and a first abnormal degree determination module 702.

[0123] The first abnormal value determination module 701 is configured to traverse the first historical transaction data of each historical transaction, and calculate a first abnormal value corresponding to each first historical transaction data according to the transaction request and each first historical transaction data;

[0124] The first abnormal degree determination module 702 is configured to determine the first abnormal degree according to each first abnormal value and the number of the first historical transaction data.

[0125] In one embodiment, referring to Figure 8 , the first abnormal value determination module 701 includes: a first dimension determination sub-module 801, a first dimension abnormal value determination sub-module 802, and a first abnormal value determination sub-module 803.

[0126] The first dimension determination sub-module 801 is configured to determine a plurality of first transaction information dimensions according to the transaction request;

[0127] The first dimension outlier determination sub-module 802 is configured to input, for each first transaction information dimension, the current transaction value of the transaction request under this first transaction information dimension and the historical transaction value of the first historical transaction data under this first transaction information dimension into an indication function, to obtain a first dimension outlier of the transaction request under this first transaction information dimension;

[0128] The first outlier determination sub-module 803 is configured to determine the first outlier according to each first dimension outlier and the number of the first transaction information dimensions.

[0129] In one embodiment, referring to Figure 9 , the second historical transaction data includes: the historical transaction data to be measured and the reference historical transaction data; the second anomaly degree determination unit 602 includes: a second outlier determination module 901, a second anomaly degree determination module 902, and a second anomaly degree adjustment module 903.

[0130] The second outlier determination module 901 is configured to traverse the reference historical transaction data and calculate, according to the historical transaction data to be measured and each reference historical transaction data, a second outlier corresponding to each reference historical transaction data;

[0131] The second anomaly degree determination module 902 is configured to determine the second anomaly degree according to each second outlier and the number of the reference historical transaction data;

[0132] The second anomaly degree adjustment module 903 is configured to adjust the second anomaly degree by using an exponential smoothing algorithm.

[0133] In one embodiment, referring to Figure 10 , the second outlier determination module 901 includes: a second dimension determination sub-module 1001, a second dimension outlier determination sub-module 1002, and a second outlier determination sub-module 1003.

[0134] The second dimension determination sub-module 1001 is configured to determine a plurality of second transaction information dimensions according to the historical transaction data to be measured;

[0135] The second dimension outlier determination sub-module 1002 is configured to input, for each second transaction information dimension, the to-be-measured transaction value of the historical transaction data to be measured under this second transaction information dimension and the reference transaction value of the reference historical transaction data under this second transaction information dimension into an indication function, to obtain a second dimension outlier of the historical transaction data to be measured under this second transaction information dimension;

[0136] The second outlier determination sub-module 1003 is configured to determine the second outlier according to each second-dimensional outlier and the number of dimensions of the second transaction information dimension.

[0137] In one embodiment, the abnormal transaction warning device is further specifically configured to:

[0138] Obtain the first historical transaction data and / or the second historical transaction data from the historical transaction database.

[0139] In one embodiment, the abnormal transaction warning device is further specifically configured to:

[0140] When the first abnormal degree is higher than the first risk threshold, perform an abnormal transaction warning on the transaction request.

[0141] In one embodiment, the warning processing unit is further specifically configured to:

[0142] When the second abnormal degree is higher than the second risk threshold, perform an abnormal transaction warning on the transaction request.

[0143] From a hardware perspective, in order to be able to perform abnormal transaction warning based on the historical transaction data of the transaction initiator and the transaction recipient, the present application provides an embodiment of an electronic device for implementing all or part of the content in the abnormal transaction warning method. The electronic device specifically includes the following:

[0144] A processor, a memory, a communication interface, and a bus; wherein, the processor, the memory, and the communication interface complete communication with each other through the bus; the communication interface is used to implement information transmission between the abnormal transaction warning device and related devices such as the core business system, the user terminal, and the related database, etc. This logic controller can be a desktop computer, a tablet computer, a mobile terminal, etc., and this embodiment is not limited thereto. In this embodiment, this logic controller can be implemented with reference to the embodiments of the abnormal transaction warning method and the embodiments of the abnormal transaction warning device in the embodiments, and the content is incorporated herein, and the repeated parts will not be elaborated.

[0145] It can be understood that the user terminal may include a smart phone, a tablet electronic device, a network set-top box, a portable computer, a desktop computer, a personal digital assistant (PDA), a vehicle-mounted device, a smart wearable device, etc. Among them, the smart wearable device may include smart glasses, smart watches, smart bracelets, etc.

[0146] In practical applications, part of the abnormal transaction warning method can be executed on the side of the electronic device as described above, or all operations can be completed in the client device. Specifically, it can be selected according to the processing capacity of the client device and the limitations of the user usage scenario, etc. This application does not make any limitations in this regard. If all operations are completed in the client device, the client device may further include a processor.

[0147] The above-mentioned client device may have a communication module (i.e., a communication unit), and can be communicatively connected to a remote server to achieve data transmission with the server. The server may include a server on the side of the task scheduling center, and in other implementation scenarios, it may also include a server of an intermediate platform, such as a server of a third-party server platform having a communication link with the task scheduling center server. The server may include a single computer device, or may include a server cluster composed of multiple servers, or a server structure of a distributed device.

[0148] Figure 11 It is a schematic block diagram of the system composition of the electronic device 9600 according to an embodiment of the present application. As Figure 11 shown, the electronic device 9600 may include a central processing unit 9100 and a memory 9140; the memory 9140 is coupled to the central processing unit 9100. It should be noted that this Figure 11 is exemplary; other types of structures can also be used to supplement or replace this structure to implement telecommunication functions or other functions.

[0149] In one embodiment, the function of the abnormal transaction warning method can be integrated into the central processing unit 9100. Among them, the central processing unit 9100 can be configured to perform the following controls:

[0150] S101: Determine the first abnormal degree of the transaction request according to the transaction request of the transaction initiator and the first historical transaction data;

[0151] S102: When the first abnormal degree is lower than a preset first risk threshold, determine the second abnormal degree of the transaction recipient according to the second historical transaction data of the transaction recipient;

[0152] S103: Perform abnormal transaction warning processing according to the second abnormal degree and a preset second risk threshold.

[0153] As can be seen from the above description, the abnormal transaction warning method provided by this application can calculate the abnormality degree of this transaction request according to the distribution of the transaction request and historical transaction data in hyperspace. Compared with the existing Minkowski distance, it is more sensitive to the uneven data distribution density in space and can more accurately distinguish the abnormality degree of transactions; through the gray list of transaction accounts, transactions transferring funds to the gray list can be quickly screened out, improving the abnormal detection efficiency of the system.

[0154] In another embodiment, the abnormal transaction warning device can be separately configured from the central processing unit 9100. For example, the data composite transmission device abnormal transaction warning device can be configured as a chip connected to the central processing unit 9100, and the functions of the abnormal transaction warning method can be realized through the control of the central processing unit.

[0155] As Figure 11 shown, the electronic device 9600 may further include: a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, and a power supply 9170. It should be noted that the electronic device 9600 does not necessarily have to include Figure 11 all the components shown in Figure 11 ; in addition, the electronic device 9600 may further include

[0156] As Figure 11 shown, the central processing unit 9100 is sometimes also referred to as a controller or operation control, and may include a microprocessor or other processor devices and / or logic devices. The central processing unit 9100 receives inputs and controls the operations of the various components of the electronic device 9600.

[0157] Among them, the memory 9140, for example, may be one or more of a buffer, a flash memory, a hard drive, a removable medium, a volatile memory, a non-volatile memory, or other suitable devices. The above information related to failures can be stored, and in addition, programs for executing relevant information can also be stored. And the central processing unit 9100 can execute the program stored in the memory 9140 to implement information storage or processing, etc.

[0158] The input unit 9120 provides inputs to the central processing unit 9100. The input unit 9120 is, for example, a key or a touch input device. The power supply 9170 is used to provide power to the electronic device 9600. The display 9160 is used to display display objects such as images and texts. The display may be, for example, an LCD display, but is not limited thereto.

[0159] The memory 9140 may be a solid-state memory, for example, a read-only memory (ROM), a random access memory (RAM), a SIM card, etc. It may also be a memory that stores information even when power is off, can be selectively erased and has more data. Examples of such a memory are sometimes referred to as EPROMs, etc. The memory 9140 may also be some other type of device. The memory 9140 includes a buffer memory 9141 (sometimes referred to as a buffer). The memory 9140 may include an application / function storage unit 9142 for storing application programs and function programs or the processes for operating the electronic device 9600 by the central processing unit 9100.

[0160] The memory 9140 may also include a data storage unit 9143 for storing data such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit 9144 of the memory 9140 may include various drivers of the electronic device for communication functions and / or for performing other functions of the electronic device (such as a messaging application, an address book application, etc.).

[0161] The communication module 9110 is a transmitter / receiver 9110 that transmits and receives signals via the antenna 9111. The communication module (transmitter / receiver) 9110 is coupled to the central processing unit 9100 to provide input signals and receive output signals, which may be the same as in the case of a conventional mobile communication terminal.

[0162] Based on different communication technologies, multiple communication modules 9110 may be provided in the same electronic device, such as a cellular network module, a Bluetooth module, and / or a wireless local area network module, etc. The communication module (transmitter / receiver) 9110 is also coupled to the speaker 9131 and the microphone 9132 via the audio processor 9130 to provide an audio output via the speaker 9131 and receive an audio input from the microphone 9132, thereby implementing normal telecommunication functions. The audio processor 9130 may include any suitable buffer, decoder, amplifier, etc. In addition, the audio processor 9130 is also coupled to the central processing unit 9100, so that recording can be performed on the local machine through the microphone 9132 and the sound stored on the local machine can be played through the speaker 9131.

[0163] Embodiments of the present application also provide a computer-readable storage medium capable of implementing all steps of the abnormal transaction warning method in the above embodiments where the execution entity is a server or a client. A computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, all steps of the abnormal transaction warning method in the above embodiments where the execution entity is a server or a client are implemented. For example, when the processor executes the computer program, the following steps are implemented:

[0164] S101: Determine the first abnormal degree of the transaction request according to the transaction request of the transaction initiator and the first historical transaction data;

[0165] S102: When the first abnormal degree is lower than a preset first risk threshold, determine the second abnormal degree of the transaction recipient according to the second historical transaction data of the transaction recipient;

[0166] S103: Perform abnormal transaction warning processing according to the second abnormal degree and a preset second risk threshold.

[0167] As can be seen from the above description, the abnormal transaction warning method provided by the present application can calculate the abnormal degree of this transaction request according to the distribution of the transaction request and the historical transaction data in hyperspace. Compared with the existing Minkowski distance, it is more sensitive to the uneven distribution density of data in space and can more accurately distinguish the abnormal degree of transactions; through the transaction account gray list, transactions transferring funds to the gray list can be quickly screened out, improving the abnormal detection efficiency of the system.

[0168] Those skilled in the art should understand that the embodiments of the present invention can be provided as a method, apparatus, or computer program product. Therefore, the present invention can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0169] The present invention is described with reference to the flowcharts and / or block diagrams of methods, devices (apparatuses), and computer program products according to embodiments of the present invention. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate for implementing in the process Figure 1 one process or multiple processes and / or blocks Figure 1Apparatus for the functions specified in one or more boxes.

[0170] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to work in a particular manner, such that the instructions stored in the computer-readable memory produce a manufacture including an instruction apparatus that implements the functions specified in one Figure 1 process or more processes and / or boxes Figure 1 or more boxes.

[0171] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus, such that a series of operation steps are executed on the computer or other programmable apparatus to produce a computer-implemented process, so that the instructions executed on the computer or other programmable apparatus provide steps for implementing the functions specified in one Figure 1 process or more processes and / or boxes Figure 1 or more boxes.

[0172] In the present invention, specific embodiments are used to elaborate the principles and implementation manners of the present invention. The description of the above embodiments is only used to help understand the method and its core idea of the present invention; at the same time, for those of ordinary skill in the art, according to the idea of the present invention, there will be changes in the specific implementation manners and application scopes. In summary, the content of this specification should not be construed as a limitation to the present invention.

Claims

1. An abnormal transaction warning method, characterized in that, Including: Determining a first anomaly degree of the transaction request according to a transaction request of a transaction initiator and first historical transaction data, including: traversing the first historical transaction data of each historical transaction, and calculating a first anomaly value corresponding to each of the first historical transaction data according to the transaction request and each of the first historical transaction data; determining the first anomaly degree according to each of the first anomaly values and the number of the first historical transaction data; When the first anomaly degree is lower than a preset first risk threshold, determining a second anomaly degree of the transaction recipient according to second historical transaction data of the transaction recipient; the second historical transaction data includes: to-be-tested historical transaction data and reference historical transaction data; The determining the second anomaly degree of the transaction recipient according to the second historical transaction data of the transaction recipient includes: traversing the reference historical transaction data, and calculating a second anomaly value corresponding to each of the reference historical transaction data according to the to-be-tested historical transaction data and each of the reference historical transaction data; determining the second anomaly degree according to each of the second anomaly values and the number of the reference historical transaction data; adjusting the second anomaly degree by using an exponential smoothing algorithm; Performing an abnormal transaction warning process according to the second anomaly degree and a preset second risk threshold; Wherein, the traversing the first historical transaction data of each historical transaction, and calculating the first anomaly value corresponding to each of the first historical transaction data according to the transaction request and each of the first historical transaction data includes: determining a plurality of first transaction information dimensions according to the transaction request; for each first transaction information dimension, inputting a current transaction value of the transaction request under the first transaction information dimension and a historical transaction value of the first historical transaction data under the first transaction information dimension into an indicator function to obtain a first dimension anomaly value of the transaction request under the first transaction information dimension; determining the first anomaly value according to each first dimension anomaly value and the number of the first transaction information dimensions; Wherein, the calculating the second anomaly value corresponding to each of the reference historical transaction data according to the to-be-tested historical transaction data and each of the reference historical transaction data includes: determining a plurality of second transaction information dimensions according to the to-be-tested historical transaction data; for each second transaction information dimension, inputting a to-be-tested transaction value of the to-be-tested historical transaction data under the second transaction information dimension and a reference transaction value of the reference historical transaction data under the second transaction information dimension into an indicator function to obtain a second dimension anomaly value of the to-be-tested historical transaction data under the second transaction information dimension; determining the second anomaly value according to each second dimension anomaly value and the number of the second transaction information dimensions.

2. The abnormal transaction warning method according to claim 1, wherein, Also including: Obtaining the first historical transaction data and / or the second historical transaction data from a historical transaction database.

3. The abnormal transaction warning method according to claim 1, characterized in that Also including: When the first anomaly degree is higher than the first risk threshold, giving an abnormal transaction warning for the transaction request.

4. The abnormal transaction warning method according to claim 1, wherein The performing an abnormal transaction warning process according to the second anomaly degree and a preset second risk threshold includes: When the second abnormal degree is higher than the second risk threshold, an abnormal transaction warning is given for the transaction request.

5. An abnormal transaction warning device, characterized in that, Including: A first abnormal degree determination unit, configured to determine a first abnormal degree of the transaction request according to the transaction request of the transaction initiator and first historical transaction data; The first abnormal degree determination unit includes: a first abnormal value determination module and a first abnormal degree determination module; The first abnormal value determination module is configured to traverse the first historical transaction data of each historical transaction, and calculate a first abnormal value corresponding to each of the first historical transaction data according to the transaction request and each of the first historical transaction data; Specifically, the first abnormal value determination module is configured to determine a plurality of first transaction information dimensions according to the transaction request; for each first transaction information dimension, input the current transaction value of the transaction request under the first transaction information dimension and the historical transaction value of the first historical transaction data under the first transaction information dimension into an indicator function to obtain a first dimension abnormal value of the transaction request under the first transaction information dimension; determine the first abnormal value according to each first dimension abnormal value and the number of the first transaction information dimensions; The first abnormal degree determination module is configured to determine the first abnormal degree according to each of the first abnormal values and the number of the first historical transaction data; A second abnormal degree determination unit, configured to, when the first abnormal degree is lower than a preset first risk threshold, determine a second abnormal degree of the transaction recipient according to second historical transaction data of the transaction recipient; the second historical transaction data includes: to-be-tested historical transaction data and reference historical transaction data; The second abnormal degree determination unit includes: a second abnormal value determination module, a second abnormal degree determination module, and a second abnormal degree adjustment module; The second abnormal value determination module is configured to traverse the reference historical transaction data, and calculate a second abnormal value corresponding to each of the reference historical transaction data according to the to-be-tested historical transaction data and each of the reference historical transaction data; Specifically, the second abnormal value determination module is configured to determine a plurality of second transaction information dimensions according to the to-be-tested historical transaction data; for each second transaction information dimension, input the to-be-tested transaction value of the to-be-tested historical transaction data under the second transaction information dimension and the reference transaction value of the reference historical transaction data under the second transaction information dimension into an indicator function to obtain a second dimension abnormal value of the to-be-tested historical transaction data under the second transaction information dimension; determine the second abnormal value according to each second dimension abnormal value and the number of the second transaction information dimensions; The second abnormal degree determination module is configured to determine the second abnormal degree according to each of the second abnormal values and the number of the reference historical transaction data; The second abnormal degree adjustment module is configured to adjust the second abnormal degree by using an exponential smoothing algorithm; An early warning processing unit, configured to perform abnormal transaction early warning processing according to the second abnormal degree and a preset second risk threshold.

6. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the abnormal transaction warning method according to any one of claims 1 to 4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the abnormal transaction warning method described in any one of claims 1 to 4.

8. A computer program product comprising computer programs / instructions, characterized in that, When the computer program / instructions are executed by a processor, it implements the steps of the abnormal transaction warning method described in any one of claims 1 to 4.

Images